Search: “patch review”

252 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 73 Vulnerability 67 Industry 33 Advisory 26 AI safety & security 15 Policy & legal 12 Malware 9 Tools 9 Threat actor 8 Research 8 AI industry 5 Data breach 5 AI tools & infra 3 Ransomware 2

SeverityAll critical 41 high 105 medium 42 low 10 info 83

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · securitySep 15, 20:03 UTC · 1d agoResearch

Oracle Critical Security Patch Update, September 2026 Review

Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.

Oracle released 673 security patches in its September 2026 Critical Patch Update: 104 rated critical, 503 high, and 59 medium. Oracle E-Business Suite received the most patches (159, 24% of total), with 19 exploitable without credentials including CVE-2026-83327, CVE-2026-83452, and CVE-2026-83462 at CVSS 9.8. Fusion Middleware received 153 patches with 78 remotely exploitable without authentication, and 41 patches address third-party open-source component flaws. Qualys published detection QIDs for vulnerable assets.

Qualys ThreatPROTECTSep 16, 14:15 UTC · 11h agoAdvisory CVE-2026-83154 CVE-2026-83196 CVE-2026-83197+10 CVEs

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.

Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.

Qualys ThreatPROTECTAug 19, 13:49 UTC · 28d agoAdvisory2

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECTSep 9, 12:23 UTC · 7d agoVulnerability in the wildCVE-2026-81963 CVE-2026-85880 CVE-2026-58599+27 CVEs

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net SecurityAug 30, 00:00 UTC · 18d agoIndustry in the wildCVE-2026-73570 CVE-2026-60004 CVE-2026-8452

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access

WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.

WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.

Cyber Security NewsSep 16, 15:05 UTC · 10h agoVulnerability 3 sources CVE-2026-5430

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security NewsSep 15, 13:52 UTC · 1d agoVulnerability

We have a year to fix security everywhere

Blog post warns that cheap open-weight GLM 5.3-flash, once abliterated, could enable mass AI-driven vulnerability exploitation, urging industry-wide patching now.

An essay argues that Z.ai's open-weight GLM 5.3-flash—runnable locally on roughly $6k consumer hardware at 20-45 tokens/second—combined with 'abliterated' variants from groups like DeAlignAI that score 0% on HarmBench-320 puts dangerous hacking capability in nearly anyone's hands. GLM 5.3 scores 84.5% on CyberGym and 54.4% on ExploitBench, versus GPT-6 Astra's 100% and GPT-5.6 Sol's 78.5%, and the author cites evidence of frontier models exploiting real-world infrastructure. The author calls for using LLMs (Project Glasswing, Daybreak) to find and fix vulnerabilities industry-wide before adversaries weaponize cheap open models.

Hacker News · securitySep 8, 04:48 UTC · 8d agoAI safety & security HN 278↑ · 292 comments

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 13d agoTools

Microsoft breaks Patch Tuesday record with 974-CVE deluge

Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.

Microsoft's September Patch Tuesday addresses 974 CVEs, including two zero-days already under exploitation: CVE-2026-85880, a Windows ALPC privilege escalation leading to SYSTEM via sandbox escape, and CVE-2026-81963, a Windows Update Stack privilege escalation. Adobe patched 172 CVEs, including the max-severity StyleSmuggler zero-day CVE-2026-75650 in Magento and Adobe Commerce, which Sansec reports is being exploited since September 4 to inject PHP into templates and install a C2-connected backdoor. CISA added CVE-2026-85880, CVE-2026-81963, and CVE-2026-75650 to its Known Exploited Vulnerabilities Catalog with patch deadlines of September 22 and September 11. The piece also notes Google-patched Chrome V8 zero-day CVE-2026-85046 lacks a Microsoft advisory for Edge, and flags nine Exchange Server flaws including remote unauthenticated RCE CVE-2026-55007.

The Register · SecuritySep 9, 00:25 UTC · 8d agoExploit / PoC in the wildCVE-2026-75650 CVE-2026-85880 CVE-2026-81963+3 CVEs1

GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests

OpenAI releases GPT-6 Astra, scoring 100% on ExploitBench, but restricts it to secure code review by blocking PoC exploit generation.

OpenAI officially unveiled GPT-6 Astra days after the model reached the "Critical" cybersecurity capability threshold under its Preparedness Framework. The model claims 100% on ExploitBench (versus 78.5% for GPT-5.6 Sol), 98% on FrontierMath Tier 4, and 99.9% on ARC-AGI-3, and demonstrated exploit development including on two zero-days disclosed between June and August 2026. The released version is limited to secure code review and patching and refuses proof-of-concept exploit requests, with less restrictive safeguards planned via OpenAI Daybreak. OpenAI also launched a $1 billion "Daybreak for Frontline Defenders" program for critical infrastructure sectors and a pilot with the US MS-ISAC for public sector and water system defenders.

The Hacker NewsSep 4, 06:47 UTC · 12d agoModel release1

Cybersecurity attention fades within months after a breach

ManageEngine survey of 700 breached organizations finds security attention fades within one to six months, while 91% still trust their posture.

A ManageEngine survey of 700 IT and security leaders in the US and Canada, all of whom had experienced a breach, found that 91% trust their current security posture and only 8% make security a permanent priority after an incident. 80% said post-breach focus lasts just one to six months, and nearly half made no wider changes after their incident. About two in three organizations using AI in security said they act on AI recommendations without additional verification. The report also flagged unclear ownership across security, IT, and business teams as a cause of delayed remediation.

Help Net SecuritySep 14, 05:00 UTC · 2d agoIndustry

Apache Superset SQL Injection Flaw Gets Public PoC Exploit

A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.

A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.

GBHackersSep 16, 09:23 UTC · 16h agoExploit / PoC 2 sources CVE-2026-23980

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.

GBHackersSep 8, 10:24 UTC · 8d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+8 CVEs1

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.

PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.

The Hacker NewsSep 4, 15:20 UTC · 12d agoVulnerability CVE-2026-64711

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project ZeroSep 8, 07:00 UTC · 8d agoResearch1

The Apple Security Update Review for September 2026

Apple's September 2026 updates patch 45+ flaws, including a 9.8 Screen Sharing authentication bypass (CVE-2026-65400) already listed in CISA's KEV.

ZDI's review of Apple's September 2026 security updates catalogs dozens of CVEs across macOS, iOS, iPadOS, watchOS and other platforms. CVE-2026-65400 (CVSS 9.8) lets a network attacker authenticate to Screen Sharing Server without valid credentials and is flagged as KEV, while CVE-2026-65414 (CVSS 9.8) enables remote code execution via Bluetooth. The set also includes 8.8-rated memory corruption flaws in WebKit, WebRTC, CUPS, ImageIO and the kernel, plus sandbox escapes, privilege escalations to root, and arbitrary code execution via crafted files.

Zero Day Initiative BlogSep 16, 19:58 UTC · 5h agoVulnerability in the wildCVE-2026-65400 CVE-2026-65414 CVE-2026-43692+27 CVEs

Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...

JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.

JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:42 UTC · 8d agoVulnerability CVE-2026-63077

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Attackers exploit MLflow SSRF CVE-2026-64849 (CVSS 9.3) to steal cloud credentials; CISA added it to KEV; FUXA flaw CVE-2026-25895 is being scanned.

watchTowr observed exploitation of MLflow CVE-2026-64849, an unauthenticated SSRF (CVSS 9.3) affecting versions below 3.15.0, within hours of CVE assignment on August 17, 2026, with attackers abusing model-registry webhooks to reach cloud metadata endpoints and exfiltrate credentials and secrets. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 19, 2026, with a September 2 patch deadline for federal civilian agencies. VulnCheck reported scanning of FUXA CVE-2026-25895 (missing authentication plus path traversal, CVSS 9.5, versions through 1.2.9) beginning August 18; about 60 FUXA instances are exposed and no RCE payloads have been dropped yet.

The Hacker NewsAug 20, 05:48 UTC · 27d agoExploit / PoC in the wildCVE-2026-64849 CVE-2026-25895 CVE-2026-25939+1 CVEs

AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489

Canadian Cyber Centre alerts on Citrix NetScaler ADC/Gateway flaws CVE-2026-19490 (authentication bypass) and CVE-2026-19489 (buffer overflow), urging emergency patching.

The Canadian Centre for Cyber Security issued alert AL26-019 covering two Citrix NetScaler vulnerabilities disclosed in a vendor advisory on August 19, 2026. CVE-2026-19490 (CWE-288) allows a remote unauthenticated attacker to bypass authentication on appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. CVE-2026-19489 (CWE-120) is a classic buffer overflow that may cause memory overflow, unpredictable behavior, or denial-of-service conditions. Affected appliances are vulnerable when configured as a SAML IdP; fixed versions include 14.1-73.32, 13.1-63.21, and 13.1-37.277 for FIPS.

Canadian Centre for Cyber SecuritySep 4, 19:00 UTC · 12d agoAdvisory 3 sources CVE-2026-19490 CVE-2026-19489

Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS

New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.

Panzer, a ransomware-as-a-service operation that surfaced August 5, listed a kitchen manufacturer in Treviso (Doimo Cucine) and a telecommunications engineering firm in Catanzaro (NTE Italia) among alleged victims, claiming 30 GB and 16 GB of stolen data respectively. The group advertises encryptors for Windows, Linux, FreeBSD, and VMware ESXi, a Tox-based affiliate recruitment process with screening, an affiliate dashboard, and an 80/20 revenue split. Neither victim had publicly confirmed the incidents when researcher Andrea Fortuna's report was published, and the group's first access method and payload have not been independently analyzed. Panzer posted victims across 11 countries as claimed Italian ransomware incidents reached 212 by September 6, already above 2025's full-year total of 169.

Cyber Security NewsSep 8, 09:10 UTC · 8d agoRansomware in the wild

Oracle’s September patches put Fusion Middleware back in the hot seat

Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.

Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.

CSO OnlineSep 16, 15:54 UTC · 9h agoVulnerability CVE-2026-71133 CVE-2026-83099 CVE-2026-83059+16 CVEs

wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)

Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.

wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sources CVE-2026-63030 CVE-2026-601371

Cybersecurity jobs available right now: March 31, 2026

Help Net Security's job roundup lists cybersecurity vacancies worldwide, from malware research director to SOC, IAM, and GRC roles, mostly already closed.

The roundup aggregates cybersecurity openings across Israel, Ireland, India, the UK, Australia, France, Germany, Canada, the US and the UAE. Roles include Android malware research director, cloud security engineer, IAM analyst, SOC lead, GRC specialist, and vulnerability management positions at employers such as Iceland Foods, Pernod Ricard, A10 Networks, and TOMRA. Most listings were marked as no longer accepting applications at publication.

Help Net SecurityAug 28, 09:05 UTC · 19d agoIndustry

CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks

CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.

CISA added CVE-2026-85706, a CVSS 10.0 path traversal vulnerability in GitLab's repository commits API, to its Known Exploited Vulnerabilities catalog on September 11, 2026. The flaw affects GitLab CE/EE versions 18.7-19.1.7, 19.2-19.2.5, and 19.3-19.3.1, allowing unauthenticated attackers to read arbitrary files from affected servers without user interaction. Fixes are available in GitLab 19.1.8, 19.2.6, and 19.3.2, and federal civilian agencies must remediate by September 14, 2026 under Binding Operational Directive 26-04. GitLab credited researcher s3ntago via HackerOne; arbitrary file disclosure could expose credentials, tokens, and CI/CD secrets useful for follow-on intrusions.

Cyber Security Newsupdated Sep 15, 00:52 UTC · 2d agofirst Sep 12, 04:32 UTC · 4d agoExploit / PoC in the wild 18 sources CVE-2026-857062· 1 read

Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities

Google open-sourced Mantis, an Apache-2.0 modular skills toolkit that lets AI coding agents find, reproduce, and patch vulnerabilities with sandboxed verification.

Google released Mantis on GitHub under Apache 2.0 as a stack-agnostic set of slash-command skills that chain through the full vulnerability lifecycle: mining version history, building threat models, filtering findings, reproducing bugs in gVisor or network-disabled VMs, assembling exploit chains, patching, and scoring residual risk from 1 to 10. It runs with Gemini CLI, Antigravity CLI, the Google ADK, or comparable agent frameworks, and a supervisor skill (/mantis-meta-agent) can drive the whole loop. Google says the design targets the sub-7 percent true-positive rate of naive AI code scanning, and that its hierarchical summary tree cuts token overhead by over 85 percent. The toolkit is deployable for local and internal evaluation but not yet recommended for production.

MarkTechPostSep 9, 22:58 UTC · 7d agoAI tools & infra

Introducing the CyberAgents Exchange AI Inspector: Rigorous review for community-built AI

Tenable and OpenAI launch the CyberAgents Exchange AI Inspector to security-review community-submitted AI agents, MCP servers, and skills using GPT Cyber models.

Tenable and OpenAI announced the CyberAgents Exchange AI Inspector, unveiled at OpenAI's "Intelligence at Work: Cyber Summit," to vet community-submitted AI agents, skills, MCP servers, and multi-agent playbooks in the CyberAgents Exchange registry. The process combines Tenable One AI Exposure scanning, OpenAI GPT Cyber model assessment, and human review, with reviews anchored to specific Git commits. The registry launched in August and hosts over 100 AI listings; the Inspector is expected to be available in September and has already detected prompt injection implemented via invisible Unicode tag characters in a SKILL.md file.

Tenable BlogSep 9, 13:00 UTC · 7d agoTools

AL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060

Canada's Cyber Centre warns of three exploited MikroTik RouterOS vulnerabilities affecting SSH-exposed devices; CISA added two to its KEV catalog.

The Canadian Centre for Cyber Security issued alert AL26-020 for three MikroTik RouterOS vulnerabilities, especially on devices exposing SSH to the internet: CVE-2026-67277 (missing authentication, CWE-306, enabling sensitive information disclosure), CVE-2026-86060 (argument injection, CWE-88, enabling privilege escalation), and CVE-2026-67276 (improper cryptographic signature verification, CWE-347, allowing SSH command channel access without the private key). On September 10, 2026, CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities catalog. Fixed versions include RouterOS 6.49.21, 7.23.4 (Long-Term), 7.24.2 (Stable), and 7.25 beta 3.

Canadian Centre for Cyber Securityupdated Sep 11, 11:57 UTC · 5d agofirst Sep 10, 19:50 UTC · 6d agoVulnerability in the wild 2 sources CVE-2026-67276 CVE-2026-67277 CVE-2026-860603· 2 reads

OpenAI Announced $1B in Defensive Tools for Water Utilities

OpenAI pledges $1 billion in subsidized Daybreak cyber models and training for water utilities, grid operators, and other critical-infrastructure defenders.

OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion in product credits and subsidized access to its Daybreak cyber models, training, and technical support for under-resourced defenders. Priority access goes to water and wastewater utilities, electric grid operators, state and local governments, community banks, nonprofits, and open-source maintainers; around 2,000 organizations already use Daybreak, which includes Daybreak Blue and Daybreak Red tiers. The program includes an MS-ISAC pilot, the Daybreak Defense Network with 35+ partner products (including HackerOne), and publication of OpenAI's Defense Factory automated vulnerability discovery architecture; it launched the same day OpenAI shipped a model it internally classifies as Critical for cyber capability.

Security AffairsSep 5, 21:14 UTC · 11d agoAI industry

OpenAI is putting $1 billion behind Daybreak for defenders working without enterprise budgets

OpenAI committed $1 billion to subsidize Daybreak cyber model access, training, and support for water, grid, government, banking, nonprofit, and open-source defenders.

OpenAI committed $1 billion in credits to subsidize access to its Daybreak cyber models, along with training and technical support, for defenders of water and wastewater systems, the electric grid, state and local government, community banks, nonprofits, and open-source projects. The commitment is targeted for consumption over roughly six months, starting in the United States, and follows a smaller $1 million program offered after recent attacks on US water systems. A pilot with MS-ISAC pairs Daybreak access with guided training, and more than 35 partner products joined the Daybreak Defense Network. Thousands of defenders across 2,000 approved organizations already use the service, and OpenAI also published the architecture of its agent-first Defense Factory.

Help Net SecuritySep 4, 00:00 UTC · 13d agoAI industry

Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers

AI-agent campaign exploited PaperCut CVE-2026-81578 and CVE-2026-82078, compromising 440 servers at 395 organizations and reaching Domain Admin in 12.

GreyNoise tracked a likely Russian-speaking actor that used AI agents (OpenAI Codex, a DeepSeek model) to exploit an authentication bypass (CVE-2026-81578) and unsafe-reflection RCE (CVE-2026-82078) in PaperCut NG/MF starting August 31, 2026. At least 440 servers across 395 organizations in 48 countries were compromised, with one US high school going from initial access to Domain Admin in seven minutes. Escalation relied on LSASS and registry credential harvesting, pass-the-hash, the noPac technique (CVE-2021-42278/CVE-2021-42287), new Domain Admin accounts, and DCSync to steal NTDS.DIT data. Operators staged registry hives, used Ligolo tunneling and certutil Base64 encoding for exfiltration, and one attempt was blocked by Cloudflare WAF.

GBHackersupdated Sep 11, 10:05 UTC · 5d agofirst Sep 10, 05:20 UTC · 6d agoExploit / PoC in the wild 7 sources CVE-2026-81578 CVE-2026-82078 CVE-2021-42278+1 CVEs1

OpenAI targets small utilities with $1 billion cyber defense initiative

OpenAI commits $1 billion to Daybreak for Frontline Defenders, subsidizing frontier cyber AI access and training for small utilities, governments, and critical infrastructure operators.

OpenAI President Greg Brockman announced Daybreak for Frontline Defenders, a $1 billion global commitment expanding subsidized access to Daybreak cyber models, training, and technical support. Daybreak for America will target small water and electricity providers, local governments, and banks, including a pilot with the MS-ISAC for state, local, tribal, and territorial defenders. The Daybreak Defense Network brings more than 35 enterprise partner products into the program, and attendees at OpenAI's utility summit represent 40 states serving over half the US population. Security experts welcomed the effort but cautioned that OT environments still need human-led implementation and testing before AI tooling can be safely rolled out.

CSO OnlineSep 3, 21:28 UTC · 13d agoAI industry1

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.

Cyber Security NewsSep 8, 11:19 UTC · 8d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+17 CVEs

Amasty patches dozens of Magento extensions, 2 critical

Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.

Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.

Sansec (Magento / e-commerce security)Sep 9, 15:27 UTC · 7d agoVulnerability

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber SecuritySep 11, 15:56 UTC · 5d agoAdvisory2

Debian developers rejected an LLM ban and left disclosure voluntary

Debian developers voted to encourage voluntary disclosure of AI assistance in contributions rather than banning or mandating labeling of LLM-generated code.

Debian's vote concluded August 28, with project secretary Kurt Roeckx announcing that the winning option encourages contributors to disclose generative AI assistance and stops there, adding no new mandatory review gates. The adopted resolution bars sending confidential material, embargoed security bugs, cryptographic keys and credentials to third-party AI services without explicit authorization, requires prior discussion for bulk automated work, and takes no position on whether model output is copyrightable. The project neither endorses nor prohibits generative AI and retains existing human review and licensing requirements.

Help Net SecurityAug 31, 00:00 UTC · 17d agoAI policy1

Six Maximum

Cisco patched nine critical flaws, six rated CVSS 10.0, in Crosswork platforms and Secure Workload, none known to be exploited.

Cisco released fixes for nine critical vulnerabilities in its Crosswork platforms and Secure Workload software, discovered during an internal security review that used advanced AI models. Six flaws carry CVSS 10.0 ratings, including SQL injection CVE-2026-20030 and missing authentication CVE-2026-20357 in Crosswork, and access control CVE-2026-20315 and authentication flaws CVE-2026-20317 in Secure Workload. Fixes shipped in Crosswork 7.2.1-SP, Secure Workload 3.10.9.1, and 4.0.4.16. Cisco says no exploitation has been observed.

Security AffairsAug 21, 12:30 UTC · 26d agoVulnerability CVE-2026-20030 CVE-2026-20357 CVE-2026-20358+6 CVEs1

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 5d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems

Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.

Noodle RAT (also ANGYREBEL/Nood RAT) has been active since at least mid-2016 and was long misidentified as Gh0st RAT or Rekoobe variants until Trend Micro and Cyberint classified it as a distinct multi-platform family. The Windows build (Win.NOODLERAT) is an in-memory modular shellcode backdoor delivered via MULTIDROP and MICROLOAD loaders, while the Linux build supports reverse shells, SOCKS tunneling, and cron persistence after web shell or public-facing service exploitation. It has appeared in intrusions in Thailand, India, Japan, Malaysia, and Taiwan and is linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns spanning espionage and cybercrime. Recently discovered Linux builders 1.0.1 and 1.0.2 indicate the toolkit remains actively maintained.

GBHackersupdated Sep 16, 14:03 UTC · 11h agofirst Sep 16, 12:28 UTC · 13h agoMalware in the wild 2 sources

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net SecuritySep 13, 08:00 UTC · 3d agoExploit / PoC in the wildCVE-2026-20079 CVE-2026-20316 CVE-2026-862182· 1 read